Extracted

• • Target
    5047649f467947e8d671374e52cbb6463f58e0660b4dce22a7fc9b7a15583f70.bin
  • Size 440KB
  • SHA256 5047649f467947e8d671374e52cbb6463f58e0660b4dce22a7fc9b7a15583f70
  • MD5 5bf7c66957420d9086301478c9260d9a
  • SHA1 2240f9cbdb6ed3490f0136465518309c26c30e0b
  • SHA512 6744eb0ab0f1b11fa993fcedeb759d90b019690565d3070e87b1e1ac4636982211d2babd33c10c26ed45fe35f1a13316649933fc92b7fd807e76fc7d941a7815
  • SSDEEP 12288:pYyDi5rNiQ7uysMFZzN/E/msumlkeAIhT:6yvgUlJT
  • TLSH
    T1B1A48C06F78408F8D4ABE574859265469A357C8A0F22AADF07DA633E1F327E14F39770
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xwormpersistenceprivilege_escalationrattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2